spreadcall-not-optimized-dynamic-5a.js (1119B)
1 // Tests when JSOP_OPTIMIZE_SPREADCALL no longer apply after the initial Ion 2 // compilation. 3 4 // JSOP_OPTIMIZE_SPREADCALL can be optimised when the following conditions 5 // are fulfilled: 6 // (1) the argument is an array 7 // (2) the array has no hole 8 // (3) array[@@iterator] is not modified 9 // (4) the array's prototype is Array.prototype 10 // (5) Array.prototype[@@iterator] is not modified 11 // (6) %ArrayIteratorPrototype%.next is not modified 12 13 function add(a, b) { 14 return a + b; 15 } 16 17 // Array.prototype's [[Prototype]] was changed, as a result all properties are marked as unknown. 18 function test() { 19 function maybeInvalidate() { 20 // Use a WithStatement to prevent Ion-inlining. This ensures any 21 // bailouts due to type changes don't occur in this function, but 22 // instead in the caller. 23 with ({}); 24 25 if (i === 1900) { 26 Object.setPrototypeOf(Array.prototype, null); 27 } 28 } 29 function fn(...rest) { 30 maybeInvalidate(); 31 return add(...rest); 32 } 33 for (var i = 0; i < 4000; ++i) { 34 assertEq(fn(1, 2), 3); 35 } 36 } 37 test();